only check for primary binding certificate if key algorithm even supports signing